passport-wsfed-saml2 vulnerable to Signature Bypass in SAML2 token

published 2017-12-23 8 y ago modified 2026-06-17 4 mo ago also GHSA-77fw-rf4v-vfp9 , EUVD-2023-1724

cvss: 8.1; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.4%; EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits: 0; none known

A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions < 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response (e.g., only signs the assertion within the response).

Patch / fix

fixed in 2 links 1

npm passport-wsfed-saml2 3.0.5
auth0 passport-wsfed-saml2 3.0.5

github.com/auth0/passport-wsfed-saml2@520b9fc commit

Exploit prediction

1.38% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.0	8.1	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	9.3	AV:N/AC:M/Au:N/C:C/I:C/A:C
GitHub	3.0	8.1	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	passport-wsfed-saml2	<3.0.5	3.0.5

Classification

Weakness

CWE-290 Authentication Bypass by Spoofing

References

github.com /auth0/passport-wsfed-saml2/commit/520b9fc0bb4249ce83bec47e30153419f086ab70
web
auth0.com /docs/security/bulletins/cve-2017-16897
web, vendor-advisory
github.com /auth0/passport-wsfed-saml2/security/advisories/GHSA-77fw-rf4v-vfp9
web
nvd.nist.gov /vuln/detail/CVE-2017-16897
advisory
github.com /auth0/passport-wsfed-saml2
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary